EDGEAI-1554: Make the nightly gate work, and exempt the advisory lane from it - #26

The condition was `event == schedule && last == sha`, so a manual
dispatch bypassed the change check silently. Three nightlies ran on
hal today, two of them rebuilding a commit whose nightly had already
covered it, each re-running the board lane for no new information.

Drop the event-name test so the gate applies to every trigger, and add
an explicit `force` input for deliberately re-running a green nightly.

The comparison stays against the last SUCCESSFUL run, which is what
makes this safe: a nightly that failed leaves the last success on a
different commit, so an unchanged main still re-runs without `force`.
That is the case you want after fixing a lane rather than the code,
and it is how today's runs would still have been allowed.

Signed-off-by: Sébastien Taylor <[email protected]>

The gate asked whether main had moved since the last *successful* nightly.
In a repository whose nightly is not consistently green that compares
against an arbitrarily old commit: hal's last green nightly on main was
2025-12-08, so the gate had not skipped once in nine months. Against the
live API, status=success returns 7c1bbc1c from December while
status=completed returns 06bbe5f3, which is current main -- the first
skips nothing, the second skips correctly.

A failed run still looked at the commit, so it answers the question.
Re-running an unchanged commit after fixing a lane is what `force` is
for: an explicit request rather than an accident of run history.

Forward `force` from templates/nightly.yml, which declared a bare
workflow_dispatch and gave callers copied from the skeleton no way to use
the documented override. `inputs` is null on a schedule trigger, so the
`|| false` fallback is required or the boolean input rejects an empty
string.

Signed-off-by: Sébastien Taylor <[email protected]>

The SHA-pin lint checks the shape of a pin, not that the referenced file
exists at it. Every templates/ pin is a stale placeholder, which was
harmless while they all resolved; advisories.yml is new, so a pin
predating it now 404s at run time instead of failing at lint. Say so in
the header rather than leaving a skeleton that looks copyable.

Signed-off-by: Sébastien Taylor <[email protected]>

Copilot flagged that templates/nightly.yml referenced advisories.yml at
a pin that predates it. The pin cannot be fixed as asked: no commit
containing advisories.yml exists until this merges. The defect is also
wider than that one line -- the same stale pin makes the new `force`
forwarding invalid, because the nightly-gate at eec0cb3 does not
declare that input.

Every template self-pin had drifted to a commit from nine months ago,
and a stale SHA is worse than an obviously invalid one because it still
resolves: a copied skeleton silently runs old CI. Pin them to all zeros
instead, so a skeleton that was not adjusted fails immediately and says
what to fix.

The existing SHA-pin check cannot catch this, since a stale SHA is a
valid SHA, so add a step asserting the placeholder. Verified by
extracting it verbatim from ci.yml and running it both ways: it passes
on the current templates, and on a copy with the eec0cb3 pin restored
it fails naming that exact line.

Third-party actions in templates/ keep real pins and are copyable as-is.

Signed-off-by: Sébastien Taylor <[email protected]>

A run can be cancelled before a single lane starts, yet it is still
"completed" at its commit. Taking the newest completed run meant such a
run would suppress the next night's nightly having determined nothing
about the code. Same for timed_out, stale, neutral, action_required and
startup_failure.

Count only success and failure: both mean the lanes ran and reported.
Anything else looks further back, which at worst re-runs a nightly --
the safe direction for a gate to fail.

Verified against the live API rather than a stub, using hal's ci.yml
history, which has 13 cancelled runs. On a window whose newest run is
cancelled, the old expression returns that run's sha while the new one
returns the next verdict-bearing run; on a window holding only a
cancelled run it returns empty, so the gate runs.

Signed-off-by: Sébastien Taylor <[email protected]>

copilot-instructions.md is the source of truth for the tiers and the
runner classes, and advisories.yml breaks two of its rules: Nightly runs
only when main moved, and Nightly uses the larger class. Both are broken
deliberately, but an undocumented exception is one a future contributor
or an audit will helpfully undo.

State it, with the reasoning and the limits: not gated because the
question is about the RustSec database rather than the code; hosted and
hard-coded because "cost accepted" relies on the gate bounding Nightly
to days when main moved, and an ungated lane has no such bound. Say
plainly that a lane which builds anything does not qualify, so this does
not become a general escape hatch.

Signed-off-by: Sébastien Taylor <[email protected]>